CVE-2025-43718
published 2025-10-01CVE-2025-43718: Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion)…
PriorityP410low2.9CVSS 3.1
AVLACHPRNUINSUCNINAL
EPSS
0.12%
2.5th percentile
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | poppler | < poppler 25.03.0-10 (forky) | poppler 25.03.0-10 (forky) |
| freedesktop | poppler | >= 0 < 25.03.0-10 | 25.03.0-10 |
| freedesktop | poppler | >= 24.06.1 < 25.04.0 | 25.04.0 |
CVSS provenance
nvdv3.12.9LOWCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
osv2.9LOW
vendor_debian2.9LOW
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-43718: Poppler 24
osv·2025-10-01·CVSS 2.9
CVE-2025-43718 [LOW] CVE-2025-43718: Poppler 24
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
GHSA
GHSA-77h4-r63x-87f8: Poppler 24
ghsa_unreviewed·2025-10-01
CVE-2025-43718 [MEDIUM] CWE-674 GHSA-77h4-r63x-87f8: Poppler 24
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
Ubuntu
poppler vulnerability
vendor_ubuntu·2025-10-06
CVE-2025-43718 poppler vulnerability
Title: poppler vulnerability
Summary: poppler could be made to crash if it opened a specially crafted file.
It was discovered that poppler incorrectly handled certain PDF files. If a
user or automated system were tricked into opening a specially crafted
document, a remote attacker could use this issue to cause poppler to crash,
leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
poppler: Poppler stack overflow
vendor_redhat·2025-10-01·CVSS 2.9
CVE-2025-43718 [LOW] CWE-674 poppler: Poppler stack overflow
poppler: Poppler stack overflow
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
A stack overflow flaw has been discovered in Poppler. This stack overflow which leads to a SIGSEGV crash occurs via deeply nested structures within the metadata of a PDF document. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
Statement: On Red Hat systems a proces
Debian
CVE-2025-43718: poppler - Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSE...
vendor_debian·2025·CVSS 2.9
CVE-2025-43718 [LOW] CVE-2025-43718: poppler - Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSE...
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 25.03.0-10)
sid: resolved (fixed in 25.03.0-10)
trixie: open
No detection rules found.
No public exploits indexed.
2025-10-01
Published